THIS NOTICE OF PRIVACY PRACTICES (NOTICE) DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Our Pledge Regarding Your Medical Information
Macon & Joan Brock Virginia Health Sciences EVMS Medical Group at Old Dominion University is committed to protecting your medical information. We create a record of the medical care and services you receive in our clinical sites and facilities by our health care providers for use in your care and treatment. We need this record to provide you with quality care and comply with legal requirements.
We have an obligation to: maintain the privacy of your medial information, provide you with this Notice describing our legal duties and privacy practices regarding your medical information, notify you of a breach of your unsecured medical information, and follow the terms in this Notice.
We reserve the right to change the terms in this Notice at any time. The current Notice will be posted on our website and is available in our clinical sites.
How We May Use and Disclose Medical Information About You Without Your Authorization (Permission)
The following sections describe ways that we may use and disclose your medical information without your authorization. Some medical information, such as genetic information, substance use, HIV, and mental health may be entitled to special protections by federal and/or state law. Not every use or disclosure will be listed, but the ways we are permitted to use and disclose your medical information fill fall into one of the following categories.
Treatment: We may disclose your medical information for medical treatment to physicians, residents, nurses, medical students, and health care personnel who provide, coordinate, or manage your health care within and outside our organization. For example, if you are treated for a knee injury, we may disclose your medical information to a physical rehabilitation department to coordinate your care. Medical information may also be disclosed to unaffiliated entities providing services for your health care, such as pharmacies, laboratories, hospitals, and home health agencies.
Payment: We may disclose your medical information to bill and collect payment for the treatment and services we provide to you. For example, we may disclose portions of your medical information to your health insurance plan for preauthorization or to collect payment. If you self-pay for a service in full and ask us not to share your information with your health insurance plan, we will honor your request.
Health Care Operations: We may use and disclose your medical information for health care operations. This is necessary to operate Macon & Joan Brock Virginia Health Sciences EVMS Medical Group at Old Dominion University and ensure our patients receive quality services. For example, we may use your medical information to review our quality of services, evaluate the performance of health care personnel, for teaching, training, accreditation, or to make improvements.
Health Information Exchange (HIE): We may participate in health information exchanges and may electronically share your medical information as necessary for your treatment, payment, and health care operations with HIE participants.
Business Associates: We may share your medical information with our business associates (third-party companies with signed agreements and are contracted to receive and use information only for purposes for which we have contracted their services). Examples may include records/claims processing, interpreters, call centers, legal services, etc.
Fundraising: We may contact you to provide information and/or raise funds to expand and support the health care services and educational programs we offer the community. You may “opt out” of fundraising communications by contacting our Compliance & Privacy Office (contact information can be found at the end of this Notice).
Individuals Involved in Your Care or Payment: We may share or disclose your medical information to your legal representative. We may also share your medical information to individuals that you identify as involved in your care, or help pay for your care, such as a family member. If a family member, friend, or individual is present while we discuss your medical information, we presume you consent unless you tell us otherwise. For example, we may discuss your medical information with you and the person you bring with you to your medical appointment unless you object.
Communications: We, or our business associates, may contact you via mail, telephone, or an EPIC MyChart message about your treatment, care, appointment reminders, satisfaction surveys, payment, etc. We will use your contact information we have on-file. If you want us to communicate with you in a certain way, you must provide your request in writing and provide the alternate contact information. In order to communicate with you via email or text (unsecure methods), you will need to opt-in for appointment text reminders upon registration or provide your consent.
Sign-In Sheets: We may use sign-in sheets to track your arrival and call your name in our waiting areas.
Minors: In general, parents and legal guardians are legal representatives of minor patients and must be involved in the minor’s care and consent process. We may share medical information of a minor patient to their parent or legal guardian upon request unless the minor consented to care and treatment themselves as allowed by state law.
Research: We may share medical information about you for certain research purposes in compliance with applicable federal and state laws. All research projects are subject to a special approval process. We may share de-identified information to researchers preparing a research project. When required, your written permission will be obtained prior to using your medical information for research.
Required or Permitted by Law: We may share your medical information when required or permitted by law. Examples include mandated patient registries; adverse events; health oversight agencies for licensing, auditing, and accrediting; public health activities to prevent or control disease, injury, or disability; report births and deaths; report abuse or neglect; or to notify a person who may have been exposed to a disease or condition.
Legal Proceedings, Lawsuits, and Legal Actions: We may share your medical information to courts, attorneys, court employees, and others in the course of a judicial or administrative proceeding involving an action or lawsuit brought against us or in response to a court order, subpoena, discovery request, warrant, summons or other lawful process.
Law Enforcement: We may share your medical information with law enforcement for purposes of identifying or locating a suspect, fugitive, witness, or missing person; a victim of a crime or abuse; gunshot wounds; or in response to a court order, subpoena, warrant, summons or other similar process.
Incidental Disclosures: We make reasonable efforts to limit incidental disclosures, but your medical information could be disclosed while we are conducting business or providing services to you. For example, another patient may overhear your registration information in the waiting room.
Substance Use Disorder (SUD) Treatment Information: If we receive or maintain information about you from a SUD treatment program covered by 42 CFR Part 2 (Part 2 Program) through a general consent you provide to the Part 2 Program to use and disclose the Part 2 Program record for treatment, payment, or health care operations, we may use and disclose your Part 2 Program record for treatment, payment, and health care operations as described in this Notice. If we receive or maintain your Part 2 Program record through specific consent you provide to us or another third party, we will use and disclose your Part 2 Program record only as expressly permitted by you in your consent as provided to us. In no event will we use or disclose your Part 2 Program record, or testimony that describes information contained in your Part 2 Program record, in any civil, criminal, administrative, or legislative proceedings by any Federal, State, or local authority, against you, unless authorized by your consent or by order of a court after it provides you notice of the court order.
Disaster-Relief Efforts: In an emergency, we may share your medical information to a disaster-relief organization to notify your family of your condition, status, and location.
To Avert a Serious Threat to Health or Safety: We may share your medical information to prevent a serious and imminent threat to the health and safety of yourself, another individual, or the public.
Organ, Eye, and Tissue Donation: We may share your medical information to organizations that facilitate organ, eye, or tissue procurement, donation, or transplantation.
Military: If you are a member of the armed forces, we may share your medical information to military authorities as permitted or required by law.
Workers’ Compensation: We may share your medical information for workers’ compensation as permitted or required by law.
Coroners, Medical Examiners, and Funeral Directors: We may share your medical information to a coroner, medical examiner, or funeral director to carry out their duties.
National Security and Intelligence Activities: We may share your medical information to authorized federal officials for intelligence, counterintelligence, and national security activities as permitted or required by law.
Protective Services for the President of the United States and Others: We may share your medical information to authorized federal officials for special investigations or to provide protection to the President of the United States, other authorized persons, or foreign heads of state, as permitted or required by law.
Inmates: If you are an inmate of a correctional institution or are under the custody of law enforcement, we may share your medical information with the correctional institution or law enforcement officials as permitted or required by law.
Organized Health Care Arrangement: We participate in the Sentara Accountable Care Organization, LLC (ACO) and/or Sentara Quality Care Network, LLC (CIN). Through our affiliation with the ACO and/or CIN, we and other participants are designated as an Organized Health Care Arrangement (OHCA), as defined at 45 CFR §160.103. As a member of the OHCA, we may share your medical information to the ACO and/or CIN and other ACO and/or CIN and OHCA participants for purposes of conducting quality assessment and improvement activities; utilization review; treatment, payment, or health care operations relating to the OHCA; and performing other clinically integrated network activities.
How We May Use and Disclose Medical Information About You With Your Authorization (Permission)
We may use and disclose your medical information with your authorization (permission). Not every use or disclosure will be listed, but the ways we are permitted to use and disclose medical information are described in the following categories. Authorization forms are available in our clinical sites. If you authorize us to disclose your medical information, you can later revoke that authorization in writing to stop any future uses and disclosures.
Psychotherapy Notes: We must obtain your written permission to disclose psychotherapy notes about you, except in certain circumstances. For example, written permission is not required for use of those notes by the author of the notes with respect to your treatment, use or disclosure by us for training of mental health practitioners, or use in a legal action brought by you.
Marketing: We must obtain your written permission to share your medical information for marketing purposes, except in certain circumstances. For example, written permission is not required for face‐to‐face encounters or if we are providing a communication about our own services or products. For example, we may mail you a postcard announcing the arrival of a new physician without your written permission.
Sale of PHI: We must obtain your written permission to disclose your medical information in exchange for payment.
Other Uses and Disclosures: Other uses and disclosures of your medical information not covered by the categories in this Notice or applicable regulations or laws will be made with your written permission. If you provide us with such written permission, you may revoke it at any time. We are unable to revoke disclosures previously disclosed based on prior written permission.
Your Rights Regarding Your Medical Information
You have the following rights with respect to your medical information:
Inspect and Copy: With certain exceptions, you have the right to inspect and/or receive a copy of your medical information in the format you request. This includes medical and billing records, but does not include psychotherapy notes, information for legal proceedings, or medical information restricted by regulations or laws.
Medical information about your care and treatment is available to you through your EPIC MyChart, an electronic tool that provides electronic access to your medical information.
For all other requests, you must submit your request in writing to your health care provider or appropriate clinical site. You may also complete a request form available in our clinical sites. After we receive your request and verify your identity, we may charge a reasonable fee and we will fulfill your request within 30 days.
Under certain circumstances, we may deny your request if in our health care professional’s judgement, it is believed that the release will endanger you or another individual. If denied, you may request a second review by another licensed health care professional.
Confidential Communications: You have the right to request that we communicate with you a certain way. For example, you may ask that we only contact you at your home address by mail. If you want us to communicate with you in a certain way, you must provide your request in writing and provide us with the alternate contact information.
Amendment: You have the right to ask us to change your medical information if you feel it is incorrect or incomplete. We require that you submit your request in writing to your health care provider or appropriate clinical site with a clear, explanation of the information that should be changed. If we agree, we will amend your information. In certain circumstances, if we are unable to amend or remove the information in the record, we may add supplemental information to clarify. If denied, we will provide you with a written explanation.
Accounting of Disclosures: You have the right to make a written request and receive a list of disclosures we have made of your medical information within six years prior to your request. This list will not include uses or disclosures made for treatment, payment, or healthcare operations; or disclosures to you or your legal representative. The first list requested within a twelve-month period will be free. For additional requests, we may charge a reasonable fee.
Request Restrictions: You have the right to request a restriction (limitation) on your medical information we share for treatment, payment, and health care operations. We require that you submit your request in writing to your health care provider or appropriate clinical site with a clear, explanation of the information you wish to be restricted. We are not required to agree to your request. If we agree, we will comply unless your medical information is needed for emergency treatment or we are required by law to disclose it. If you self-pay for a service in full and ask us not to share your information with your health insurance plan, we will honor your request. Due to the nature of electronic medical records, we are unable to agree to restrictions of sharing medical information for treatment purposes. For example, we cannot agree to a restriction of not sharing treatment-related information with a particular provider.
Copy and Changes to this Notice: You have the right to request and receive a paper copy of this Notice at any time to ensure you are familiar with our privacy practices. Paper copies are available from our clinical sites. We reserve the right to change this Notice effective for medical information we already have about you as well as any future medical information. We will post a current copy of this Notice on our website at: www.evms.edu/NoticeOfPrivacyPractices.
Breach Notification: You have the right to receive written notification of any breach we discover that involves your unsecured medical information. Notifications will be mailed to your address we have on-file.
Privacy Questions or Complaints: If you have questions or believe your privacy rights were violated, you may submit a complaint to our Compliance & Privacy Office. You also have the right to submit a complaint to the Secretary of the Department of Health and Human Services. You will not be penalized for submitting a complaint.
You may provide your complaint to us in writing at the following address:
Macon & Joan Brock Virginia Health Sciences
EVMS Medical Group at ODU
Compliance & Privacy Office
PO Box 936
Norfolk, VA 23501
757-451-6298
Contact Us Link: www.evmsmedicalgroup.com
Secretary of the Department of Health and Human Services:
The US Department of Health & Human Services
200 Independence Avenue, SW
Washington, DC 20201
To opt-out of fundraising, including magazine mailings, please contact us and include your name and mailing address:
Macon & Joan Brock Virginia Health Sciences
EVMS Medical Group at ODU
Compliance & Privacy Office
PO Box 936 Norfolk, VA 23501
(757) 451-6298
Contact Us Link: www.evmsmedicalgroup.com.
Effective Date of This Notice
This Notice of Privacy Practices is effective on
February 16, 2026, and replaces all earlier versions.